From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: nft_compat: make sure xtables destructors have run
Date: Fri, 31 Jul 2020 19:51:48 +0200 [thread overview]
Message-ID: <20200731175148.GA17099@salvia> (raw)
In-Reply-To: <20200724113446.29113-1-fw@strlen.de>
On Fri, Jul 24, 2020 at 01:34:46PM +0200, Florian Westphal wrote:
> Pablo Neira found that after recent update of xt_IDLETIMER the
> iptables-nft tests sometimes show an error.
>
> He tracked this down to the delayed cleanup used by nf_tables core:
> del rule (transaction A)
> add rule (transaction B)
>
> Its possible that by time transaction B (both in same netns) runs,
> the xt target destructor has not been invoked yet.
>
> For native nft expressions this is no problem because all expressions
> that have such side effects make sure these are handled from the commit
> phase, rather than async cleanup.
>
> For nft_compat however this isn't true.
>
> Instead of forcing synchronous behaviour for nft_compat, keep track
> of the number of outstanding destructor calls.
>
> When we attempt to create a new expression, flush the cleanup worker
> to make sure destructors have completed.
Applied, thanks.
next prev parent reply other threads:[~2020-07-31 17:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-24 11:34 [PATCH nf] netfilter: nft_compat: make sure xtables destructors have run Florian Westphal
2020-07-31 17:51 ` Pablo Neira Ayuso [this message]
2020-08-04 8:49 ` [netfilter] a91d31e77c: WARNING:at_lib/refcount.c:#refcount_warn_saturate kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200731175148.GA17099@salvia \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.